Skip to content
This repository was archived by the owner on Dec 13, 2023. It is now read-only.

Commit 6448a71

Browse files
jwierzboSimran-Bnerpaula
authored
GT-312 Doc for ArangoBackup example with IAM auth on EKS (#1248)
* GT-312 Doc for ArangoBackup example with IAM auth on EKS * Review, apply to 3.9 and 3.8 * Review fixes Co-authored-by: Simran Spiller <simran@arangodb.com> Co-authored-by: Paula Mihu <97217318+nerpaula@users.noreply.github.com>
1 parent d98566c commit 6448a71

File tree

4 files changed

+404
-0
lines changed

4 files changed

+404
-0
lines changed

‎3.10/deployment-kubernetes-backup-resource.md‎

Lines changed: 101 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -270,6 +270,107 @@ Required: false
270270

271271
Default: ""
272272

273+
##### Use IAM with Amazon EKS
274+
275+
Instead of creating and distributing your AWS credentials to the containers or
276+
using the Amazon EC2 instance's role, you can associate an IAM role with a
277+
Kubernetes service account and configure pods to use the service account.
278+
279+
1. Create a Policy to access the S3 bucket.
280+
281+
```bash
282+
aws iam create-policy \
283+
--policy-name S3-ACCESS_ROLE \
284+
--policy-document \
285+
'{
286+
"Version": "2012-10-17",
287+
"Statement": [
288+
{
289+
"Effect": "Allow",
290+
"Action": "s3:ListAllMyBuckets",
291+
"Resource": "*"
292+
},
293+
{
294+
"Effect": "Allow",
295+
"Action": "*",
296+
"Resource": "arn:aws:s3:::MY_BUCKET"
297+
},
298+
{
299+
"Effect": "Allow",
300+
"Action": "*",
301+
"Resource": "arn:aws:s3:::MY_BUCKET/*"
302+
}
303+
]
304+
}'
305+
```
306+
307+
2. Create an IAM role for the service account (SA).
308+
309+
```bash
310+
eksctl create iamserviceaccount \
311+
--name SA_NAME \
312+
--namespace NAMESPACE \
313+
--cluster CLUSTER_NAME \
314+
--attach-policy-arn arn:aws:iam::ACCOUNT_ID:policy/S3-ACCESS_ROLE \
315+
--approve
316+
```
317+
318+
3. Ensure that you use that SA in your ArangoDeployment for `dbservers` and
319+
`coordinators`.
320+
321+
```yaml
322+
apiVersion: database.arangodb.com/v1
323+
kind: ArangoDeployment
324+
metadata:
325+
name: cluster
326+
spec:
327+
image: arangodb/enterprise
328+
mode: Cluster
329+
330+
dbservers:
331+
serviceAccountName: SA_NAME
332+
coordinators:
333+
serviceAccountName: SA_NAME
334+
```
335+
336+
4. Create a `Secret` Kubernetes object with a configuration for S3.
337+
338+
```yaml
339+
apiVersion: v1
340+
kind: Secret
341+
metadata:
342+
name: arangodb-cluster-backup-credentials
343+
type: Opaque
344+
stringData:
345+
token: |
346+
{
347+
"s3": {
348+
"type": "s3",
349+
"provider": "AWS",
350+
"env_auth": "true",
351+
"location_constraint": "eu-central-1",
352+
"region": "eu-central-1",
353+
"acl": "private",
354+
"no_check_bucket": "true"
355+
}
356+
}
357+
```
358+
359+
5. Create an `ArangoBackup` Kubernetes object with upload to S3.
360+
361+
```yaml
362+
apiVersion: "backup.arangodb.com/v1alpha"
363+
kind: "ArangoBackup"
364+
metadata:
365+
name: backup
366+
spec:
367+
deployment:
368+
name: MY_DEPLOYMENT
369+
upload:
370+
repositoryURL: "s3:MY_BUCKET"
371+
credentialsSecretName: arangodb-cluster-backup-credentials
372+
```
373+
273374
#### `spec.download.id: string`
274375

275376
ID of the ArangoBackup to be downloaded.

‎3.11/deployment-kubernetes-backup-resource.md‎

Lines changed: 101 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -270,6 +270,107 @@ Required: false
270270

271271
Default: ""
272272

273+
##### Use IAM with Amazon EKS
274+
275+
Instead of creating and distributing your AWS credentials to the containers or
276+
using the Amazon EC2 instance's role, you can associate an IAM role with a
277+
Kubernetes service account and configure pods to use the service account.
278+
279+
1. Create a Policy to access the S3 bucket.
280+
281+
```bash
282+
aws iam create-policy \
283+
--policy-name S3-ACCESS_ROLE \
284+
--policy-document \
285+
'{
286+
"Version": "2012-10-17",
287+
"Statement": [
288+
{
289+
"Effect": "Allow",
290+
"Action": "s3:ListAllMyBuckets",
291+
"Resource": "*"
292+
},
293+
{
294+
"Effect": "Allow",
295+
"Action": "*",
296+
"Resource": "arn:aws:s3:::MY_BUCKET"
297+
},
298+
{
299+
"Effect": "Allow",
300+
"Action": "*",
301+
"Resource": "arn:aws:s3:::MY_BUCKET/*"
302+
}
303+
]
304+
}'
305+
```
306+
307+
2. Create an IAM role for the service account (SA).
308+
309+
```bash
310+
eksctl create iamserviceaccount \
311+
--name SA_NAME \
312+
--namespace NAMESPACE \
313+
--cluster CLUSTER_NAME \
314+
--attach-policy-arn arn:aws:iam::ACCOUNT_ID:policy/S3-ACCESS_ROLE \
315+
--approve
316+
```
317+
318+
3. Ensure that you use that SA in your ArangoDeployment for `dbservers` and
319+
`coordinators`.
320+
321+
```yaml
322+
apiVersion: database.arangodb.com/v1
323+
kind: ArangoDeployment
324+
metadata:
325+
name: cluster
326+
spec:
327+
image: arangodb/enterprise
328+
mode: Cluster
329+
330+
dbservers:
331+
serviceAccountName: SA_NAME
332+
coordinators:
333+
serviceAccountName: SA_NAME
334+
```
335+
336+
4. Create a `Secret` Kubernetes object with a configuration for S3.
337+
338+
```yaml
339+
apiVersion: v1
340+
kind: Secret
341+
metadata:
342+
name: arangodb-cluster-backup-credentials
343+
type: Opaque
344+
stringData:
345+
token: |
346+
{
347+
"s3": {
348+
"type": "s3",
349+
"provider": "AWS",
350+
"env_auth": "true",
351+
"location_constraint": "eu-central-1",
352+
"region": "eu-central-1",
353+
"acl": "private",
354+
"no_check_bucket": "true"
355+
}
356+
}
357+
```
358+
359+
5. Create an `ArangoBackup` Kubernetes object with upload to S3.
360+
361+
```yaml
362+
apiVersion: "backup.arangodb.com/v1alpha"
363+
kind: "ArangoBackup"
364+
metadata:
365+
name: backup
366+
spec:
367+
deployment:
368+
name: MY_DEPLOYMENT
369+
upload:
370+
repositoryURL: "s3:MY_BUCKET"
371+
credentialsSecretName: arangodb-cluster-backup-credentials
372+
```
373+
273374
#### `spec.download.id: string`
274375

275376
ID of the ArangoBackup to be downloaded.

‎3.8/deployment-kubernetes-backup-resource.md‎

Lines changed: 101 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -270,6 +270,107 @@ Required: false
270270

271271
Default: ""
272272

273+
##### Use IAM with Amazon EKS
274+
275+
Instead of creating and distributing your AWS credentials to the containers or
276+
using the Amazon EC2 instance's role, you can associate an IAM role with a
277+
Kubernetes service account and configure pods to use the service account.
278+
279+
1. Create a Policy to access the S3 bucket.
280+
281+
```bash
282+
aws iam create-policy \
283+
--policy-name S3-ACCESS_ROLE \
284+
--policy-document \
285+
'{
286+
"Version": "2012-10-17",
287+
"Statement": [
288+
{
289+
"Effect": "Allow",
290+
"Action": "s3:ListAllMyBuckets",
291+
"Resource": "*"
292+
},
293+
{
294+
"Effect": "Allow",
295+
"Action": "*",
296+
"Resource": "arn:aws:s3:::MY_BUCKET"
297+
},
298+
{
299+
"Effect": "Allow",
300+
"Action": "*",
301+
"Resource": "arn:aws:s3:::MY_BUCKET/*"
302+
}
303+
]
304+
}'
305+
```
306+
307+
2. Create an IAM role for the service account (SA).
308+
309+
```bash
310+
eksctl create iamserviceaccount \
311+
--name SA_NAME \
312+
--namespace NAMESPACE \
313+
--cluster CLUSTER_NAME \
314+
--attach-policy-arn arn:aws:iam::ACCOUNT_ID:policy/S3-ACCESS_ROLE \
315+
--approve
316+
```
317+
318+
3. Ensure that you use that SA in your ArangoDeployment for `dbservers` and
319+
`coordinators`.
320+
321+
```yaml
322+
apiVersion: database.arangodb.com/v1
323+
kind: ArangoDeployment
324+
metadata:
325+
name: cluster
326+
spec:
327+
image: arangodb/enterprise
328+
mode: Cluster
329+
330+
dbservers:
331+
serviceAccountName: SA_NAME
332+
coordinators:
333+
serviceAccountName: SA_NAME
334+
```
335+
336+
4. Create a `Secret` Kubernetes object with a configuration for S3.
337+
338+
```yaml
339+
apiVersion: v1
340+
kind: Secret
341+
metadata:
342+
name: arangodb-cluster-backup-credentials
343+
type: Opaque
344+
stringData:
345+
token: |
346+
{
347+
"s3": {
348+
"type": "s3",
349+
"provider": "AWS",
350+
"env_auth": "true",
351+
"location_constraint": "eu-central-1",
352+
"region": "eu-central-1",
353+
"acl": "private",
354+
"no_check_bucket": "true"
355+
}
356+
}
357+
```
358+
359+
5. Create an `ArangoBackup` Kubernetes object with upload to S3.
360+
361+
```yaml
362+
apiVersion: "backup.arangodb.com/v1alpha"
363+
kind: "ArangoBackup"
364+
metadata:
365+
name: backup
366+
spec:
367+
deployment:
368+
name: MY_DEPLOYMENT
369+
upload:
370+
repositoryURL: "s3:MY_BUCKET"
371+
credentialsSecretName: arangodb-cluster-backup-credentials
372+
```
373+
273374
#### `spec.download.id: string`
274375

275376
ID of the ArangoBackup to be downloaded.

0 commit comments

Comments
 (0)